sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-12-07 00:00:13 -05:00
Code Issues Projects Releases Wiki Activity

load-tester: Correctly encode serial of generated client certificates

Browse Source 
The previous approach would lead to additional zero prefixes in the
encoding of the serial (which is a positive integer, not an arbitrary
blob).

Fixes #3667.
This commit is contained in:
Tobias Brunner 2021-01-08 10:06:06 +01:00
parent d8e4a2a777
commit bd9b50dcd3
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/libcharon/plugins/load_tester/load_tester_creds.c
View File

@ -19,6 +19,7 @@
#include <sys/stat.h> #include <sys/stat.h>
#include <daemon.h> #include <daemon.h>
#include <asn1/asn1.h>
#include <credentials/keys/shared_key.h> #include <credentials/keys/shared_key.h>
#include <credentials/certificates/x509.h> #include <credentials/certificates/x509.h>
#include <utils/identification.h> #include <utils/identification.h>
@ -311,8 +312,8 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
public_key_t *peer_key, *ca_key; public_key_t *peer_key, *ca_key;
identification_t *dn = NULL; identification_t *dn = NULL;
linked_list_t *sans; linked_list_t *sans;
chunk_t serial;
char buf[128]; char buf[128];
uint32_t serial;
time_t now; time_t now;
if (this->ca == NULL) if (this->ca == NULL)
@ -355,7 +356,6 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
if (!trusted && this->private) if (!trusted && this->private)
{ {
/* peer certificate, generate on demand */ /* peer certificate, generate on demand */
serial = htonl(++this->serial);
now = time(NULL); now = time(NULL);
sans = linked_list_create(); sans = linked_list_create();
@ -376,6 +376,7 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
sans->destroy(sans); sans->destroy(sans);
return NULL; return NULL;
} }
serial = asn1_integer_from_uint64(++this->serial);
peer_key = this->private->get_public_key(this->private); peer_key = this->private->get_public_key(this->private);
peer_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509, peer_cert = lib->creds->create(lib->creds, CRED_CERTIFICATE, CERT_X509,
BUILD_SIGNING_KEY, this->private, BUILD_SIGNING_KEY, this->private,
@ -386,11 +387,12 @@ METHOD(credential_set_t, create_cert_enumerator, enumerator_t*,
BUILD_SUBJECT_ALTNAMES, sans, BUILD_SUBJECT_ALTNAMES, sans,
BUILD_NOT_BEFORE_TIME, now - 60 * 60 * 24, BUILD_NOT_BEFORE_TIME, now - 60 * 60 * 24,
BUILD_NOT_AFTER_TIME, now + 60 * 60 * 24, BUILD_NOT_AFTER_TIME, now + 60 * 60 * 24,
BUILD_SERIAL, chunk_from_thing(serial), BUILD_SERIAL, serial,
BUILD_CRL_DISTRIBUTION_POINTS, this->cdps, BUILD_CRL_DISTRIBUTION_POINTS, this->cdps,
BUILD_END); BUILD_END);
peer_key->destroy(peer_key); peer_key->destroy(peer_key);
sans->destroy(sans); sans->destroy(sans);
chunk_free(&serial);
DESTROY_IF(dn); DESTROY_IF(dn);
if (peer_cert) if (peer_cert)
{ {